Developing controls and security

Circulating a manual isn't enough. Procedures need to be understood, accepted and enforced otherwise they will be ignored.